Skip to content

Commit

Permalink
OCPBUGS-32551: swap token inactivity timeout rule
Browse files Browse the repository at this point in the history
Let's use oauth_or_oauthclient_inactivity_timeout instead of
oautclient_inactivity_timeout.
The former rule checks for server and client token timeout
configuration is multiple places and remediates the server
OAuth config.
The latter only checks for the client token timeout and doesn't have a
remediation.
  • Loading branch information
yuumasato committed Apr 23, 2024
1 parent c8d9096 commit 9160fed
Show file tree
Hide file tree
Showing 4 changed files with 4 additions and 4 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,7 @@ rationale: |-
references:
nerc-cip: CIP-004-6 R2.2.3,CIP-007-3 R5.1,CIP-007-3 R5.2,CIP-007-3 R5.3.1,CIP-007-3 R5.3.2,CIP-007-3 R5.3.3
nist: AC-2(5),SC-10
srg: SRG-APP-000190-CTR-000500

identifiers:
cce@ocp4: CCE-83511-6
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,6 @@ rationale: |-
references:
nerc-cip: CIP-004-6 R2.2.3,CIP-007-3 R5.1,CIP-007-3 R5.2,CIP-007-3 R5.3.1,CIP-007-3 R5.3.2,CIP-007-3 R5.3.3
nist: AC-2(5),SC-10
srg: SRG-APP-000190-CTR-000500

identifiers:
cce@ocp4: CCE-84178-3
Expand Down
2 changes: 1 addition & 1 deletion controls/srg_ctr/SRG-APP-000190-CTR-000500.yml
Original file line number Diff line number Diff line change
Expand Up @@ -9,4 +9,4 @@ controls:
status: automated
rules:
- sshd_disable_root_login
- oauthclient_inactivity_timeout
- oauth_or_oauthclient_inactivity_timeout
4 changes: 2 additions & 2 deletions controls/stig_ocp4.yml
Original file line number Diff line number Diff line change
Expand Up @@ -457,7 +457,7 @@ controls:
- high
title: OpenShift must disable root and terminate network connections.
rules:
- oauthclient_inactivity_timeout
- oauth_or_oauthclient_inactivity_timeout
- sshd_disable_root_login
status: automated

Expand Down Expand Up @@ -526,7 +526,7 @@ controls:
session at the end of the session, or as follows: for in-band management sessions
(privileged sessions), the session must be terminated after 10 minutes of inactivity.'
rules:
- oauthclient_inactivity_timeout
- oauth_or_oauthclient_inactivity_timeout
- sshd_disable_root_login
status: automated

Expand Down

0 comments on commit 9160fed

Please sign in to comment.